Credentials

Credentials provide daemons with the authentication details they need to gather data during discovery. Without credentials, discovery is limited to port scanning and DNS lookups. With credentials configured, daemons can also query SNMP for device details, interfaces, and neighbor data, or connect to Docker or Podman APIs for container discovery.

Credential Types

Scanopy supports these credential types, grouped by the integration they enable. Each type can be pointed at one or more targets — see Where a credential applies.

See Set up SNMP discovery, Set up Docker discovery, and Set up Podman discovery for setup instructions.

Where a credential applies

Every credential is pointed at one or more targets, which determine the hosts the daemon tries it on:

Not every type supports every target — the Can be targeted at column above shows which. SNMP can target the whole Network or specific hosts. Docker and Podman target specific hosts only: a Proxy credential can point at the Daemon host or a Remote host, while a Socket credential applies only to the Daemon host.

How to Provide Credentials

There are three ways to give daemons the credentials they need, depending on your situation:

During daemon setup (new daemons)

When creating a new daemon, the Integrations step lets you add SNMP, Docker, and Podman credentials before the first scan. For each credential you choose how it's targeted:

• Target All Hosts — the credential becomes a network default, tried on every host the daemon scans.
• Target Specific Hosts — the credential applies only to the hosts you name. Add the daemon host itself (its loopback address, 127.0.0.1 — used for local Docker and Podman sockets) or one or more remote hosts by IP.

Host-targeted credentials — including a daemon-host credential like a local Docker or Podman socket (127.0.0.1) — don't show as assigned the moment the daemon is installed. They're auto-assigned to a host only after the first scan probes them there successfully, and are then used in subsequent scans without manual assignment. Until that first scan runs, they're staged rather than assigned — that's expected, not a problem.

From the discovery modal (existing daemons, new network segments)

When an existing daemon starts scanning a new network segment or VLAN, open the discovery's Credentials tab to add credentials the same way as during daemon setup — choosing Target All Hosts or Target Specific Hosts for each.

On a host directly (existing hosts)

For hosts that have already been discovered, assign credentials from the host edit modal. Go to the Credentials tab, add the credential, and optionally restrict it to specific interfaces. This is the most targeted approach — useful when a particular device needs a different community string than the network default, or when you want to enable Docker or Podman scanning for a specific host.

You can also manage a credential's targets from the other direction: open the credential and use its Assignments tab to attach it to networks and to specific hosts (with optional per-host IP scoping).

Assigning a Credential to a Host

When you assign a credential to a host, you're linking it so that the credential is used to gather data from the host on every scan. Each assignment can optionally be scoped to specific network interfaces:

• All interfaces (default) — the credential is used whenever the daemon scans any interface on this host
• Specific interfaces — the credential is only used when scanning through those particular interfaces

Interface scoping is mainly useful for Docker Proxy credentials, where the proxy is reachable through a specific network interface.

Credential Resolution

When the daemon scans a host, it resolves credentials in this priority order:

1. Host-level assignment — credentials assigned directly to the host (or its specific interface)
2. Network default — credentials targeted at the host's whole network
3. Fallback — for SNMP, the community string public is tried as a last resort

All available credentials at each level are tried — not just the first match. If every credential fails (timeout or authentication error), the host is scanned without that credential type's data.

Auto-Assignment

Credentials created through the daemon setup wizard or discovery credentials tab support auto-assignment. When you provide a target IP during creation:

1. The credential is created with the target IP recorded
2. The daemon includes this credential in its next discovery scan, trying it on the target IP
3. If the credential succeeds (e.g., SNMP responds, Docker or Podman API connects), it is permanently assigned to the discovered host at that IP
4. The target IP is then cleared — the credential is now a regular assigned credential

This bridges the gap between "I know this device's IP and credentials" and "Scanopy hasn't discovered it yet." The credential is ready and waiting for the host to appear.

If auto-assignment isn't working as expected, see Troubleshooting credentials for how to diagnose issues using daemon logs.

Network-Level Credentials

Credentials targeted at a whole network (the Network target) can be assigned from the network edit modal (Assets > Networks → select network). All hosts on that network automatically inherit these credentials — you don't need to assign them individually.

This is the simplest way to enable SNMP across an entire network segment: create one SNMP credential with the shared community string and assign it to the network.